Half of Japanese Websites Run on WordPress... PHP Flaw Puts Japan's Government and Businesses on 'High Alert'

Websites of Japan's Finance Ministry, banks and JR West temporarily suspended
WordPress accounts for 83.1% of CMS-based sites... Japan heavily reliant on PHP
South Korea issues cyber crisis alert at "Caution" level... "Urgent response" needed

After a critical security vulnerability was discovered in the PHP programming language, websites run by Japanese government ministries, major banks, railway companies and other organizations were shut down one after another.

Yonhap News reported on October 22, citing the Yomiuri Shimbun and NHK, that "Japan's Information-technology Promotion Agency (IPA) urged operators of websites using PHP the previous day to respond swiftly." The IPA had also called on them to prepare in advance so they could apply the update as soon as it became available, after the PHP development team announced that it would release a security update at 11 p.m. on October 21.

Japan's heavy reliance on PHP puts government and corporate websites on alert

On the 22nd, a notice stating that “some services have been temporarily suspended to verify and ensure safety” was posted on the website of a Japanese investment management company. Reuters-Yonhap News.

Japan is considered to be particularly reliant on PHP compared with JavaScript and Python. According to the Japan PHP Technical Certification Organization and other sources, WordPress, a PHP-based content management system (CMS), accounts for about 83.1% of Japanese-language websites that use a CMS. Given that roughly 60% of all websites are generally built using a CMS, about half of Japanese-language websites are estimated to be based on WordPress.

Japanese Prime Minister Sanae Takaichi wrote on X, formerly Twitter, late on October 21 that the situation was "extremely urgent" and called for action related to PHP. On October 22, she again stressed the need to apply the patch to fix the vulnerability. She also said that access to her official website had been temporarily suspended and restored after the necessary measures were completed. At a press conference on October 22, Chief Cabinet Secretary Minoru Kihara, the Japanese government's spokesperson, said, "No reports of damage have been received so far," and urged operators of websites using PHP to apply the patch or suspend site operations.

The Ministry of Finance and the Ministry of Land, Infrastructure, Transport and Tourism temporarily suspended some website content and services on October 21 to conduct emergency checks and apply the patch. The National Tax Agency's website also became inaccessible before service was restored. Local governments, including Osaka Prefecture, Osaka City and Fukuoka Prefecture, suspended some website services. Kanagawa Prefectural Police temporarily shut down its driver's license renewal reservation site before reopening it, while some content, including past weather data, became unavailable on the Japan Meteorological Agency's website.

In the financial sector, MUFG Bank began a temporary system inspection, preventing customers from opening investment trust accounts through its online banking service, Mitsubishi UFJ Direct. Mizuho Bank suspended its branch visit reservation service on its website that day, while Daiwa Securities temporarily halted website services, including account opening.

Everyday services were also affected. Rakuten Group urgently inspected some pages on the main screen of its online shopping mall, Rakuten Ichiba. The websites of airline reservation service Skymark, real estate brokerage site Suumo and Daihatsu Motor's used-car information service became inaccessible. JR West suspended operations of about 60 websites across its group, including those of Hankyu Railway and Hanshin Electric Railway, making train service information and timetables unavailable.

Risk of a breach at the "heart of the web"... South Korea issues cyber crisis alert at "Caution" level

A critical security vulnerability has been discovered in the PHP programming language. Reuters-Yonhap

PHP is a programming language used for web development and is known as the "heart of the web." It powers about 70% of websites worldwide, including popular platforms such as WordPress and MediaWiki, the software behind Wikipedia. The two vulnerabilities discovered this time (CVE-2026-109618 and CVE-2026-109619), dubbed "PHP2shell," are reportedly critical threats that could allow attackers to execute malicious code remotely, steal data or alter websites.

In South Korea, the Ministry of Science and ICT issued a "Caution" level cyber crisis alert for the private sector, effective midnight on October 22. Bae Kyunghoon, Deputy Prime Minister and Minister of Science and ICT, said, "This PHP vulnerability could affect numerous websites in South Korea, and malicious code to exploit it has already been made public, so an extremely urgent response is needed."

The Korea Internet & Security Agency (KISA) posted a security update advisory on its BohoNara website on October 21 and urgently distributed information about the vulnerability to 111 major information and communications infrastructure facilities, 1,068 companies certified under the Information Security Management System (ISMS), web hosting companies and others. Organizations using PHP 8.1 or earlier, which is no longer supported, should upgrade to a supported version.

This content was produced with the assistance of AI translation services.